GoKawiilCritical EDK II UEFI flaw rated 9.5 severity exposes most server firmware
Researchers from Anthropic and Google found a memory-corruption vulnerability (CVE-2026-97631) in an ICMP component of TianoCore EDK II, the open-source codebase underlying UEFI firmware used by nearly all major hardware vendors including AMI, Insyde and Phoenix. The flaw allows code execution before the OS or protections like Secure Boot load, though the payloads it delivers aren't persistent on their own. A coordinated disclosure planned for January was disrupted after AMI published a pull request with details and a fix, prompting TianoCore to issue a public advisory early.
GoKawiil's interpretation of the reporting above, not reported fact.
Because EDK II underlies the UEFI firmware on most servers and data centers worldwide, a flaw at this stage of boot can undermine security guarantees that operating systems rely on, such as Secure Boot's chain of trust. The early public disclosure of patch code means attackers could reverse-engineer the vulnerability before many organizations have applied fixes, potentially widening the window for exploitation across cloud and enterprise infrastructure.
- CVE-2026-97631 is a 9.5-severity memory-corruption flaw in EDK II's ICMP component affecting widely used UEFI firmware.
- The bug allows pre-OS code execution capable of bypassing protections like Secure Boot, though its direct payload isn't persistent.
- A premature AMI pull request disclosure forced TianoCore to issue an early advisory, risking exploitation before patches are widely deployed.
Source: it.slashdot.org, 2026-10-27
Published there as: “Code-Execution Flaw In UEFI Firmware Threatens Most Servers On Planet Earth”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.